summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
| * merge rsa-sha256Matt Johnston2020-05-2636-267/+697
| |\
| | * rsa-sha256 for ssh-agentMatt Johnston2020-05-253-4/+13
| | |
| | * send and handle SSH_MSG_EXT_INFO only at the correct pointMatt Johnston2020-05-2413-22/+46
| | | | | | | | | | | | | | | - other fixes for rsa pubkey auth - only include ext-info handling when rsa pubkey auth is compiled
| | * run linterMatt Johnston2020-05-241-0/+1
| | |
| | * Add linter for #ifdefMatt Johnston2020-05-243-1/+13
| | |
| | * Make server send SSH_MSG_EXT_INFOMatt Johnston2020-05-216-29/+75
| | | | | | | | | | | | Ensure that only valid hostkey algorithms are sent in the first kex guess
| | * Make DEBUG_NOFORK a #if not #ifdefMatt Johnston2020-05-212-2/+4
| | |
| | * ext-info handling for server-sig-algsMatt Johnston2020-05-1916-90/+255
| | | | | | | | | | | | only client side is handled
| | * split signkey_type and signature_type for RSA sha1 vs sha256Matt Johnston2020-05-1710-68/+148
| | |
| | * use sigtype where appropriateMatt Johnston2020-04-0618-142/+233
| | |
| * | CBC mode cleanup (#95)Vladislav Grishenko2020-05-253-2/+10
| | | | | | | | | | | | | | | | | | * Fix CBC mode can't be fully disabled * Fix CBC mode can't be the only mode
| * | Add Chacha20-Poly1305, AES128-GCM and AES256-GCM support (#93)Vladislav Grishenko2020-05-2513-56/+560
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add Chacha20-Poly1305 authenticated encryption * Add general AEAD approach. * Add chacha20-poly1305@openssh.com algo using LibTomCrypt chacha and poly1305 routines. Chacha20-Poly1305 is generally faster than AES256 on CPU w/o dedicated AES instructions, having the same key size. Compiling in will add ~5,5kB to binary size on x86-64. function old new delta chacha_crypt - 1397 +1397 _poly1305_block - 608 +608 poly1305_done - 595 +595 dropbear_chachapoly_crypt - 457 +457 .rodata 26976 27392 +416 poly1305_process - 290 +290 poly1305_init - 221 +221 chacha_setup - 218 +218 encrypt_packet 1068 1270 +202 dropbear_chachapoly_getlength - 147 +147 decrypt_packet 756 897 +141 chacha_ivctr64 - 137 +137 read_packet 543 637 +94 dropbear_chachapoly_start - 94 +94 read_kex_algos 792 880 +88 chacha_keystream - 69 +69 dropbear_mode_chachapoly - 48 +48 sshciphers 280 320 +40 dropbear_mode_none 24 48 +24 dropbear_mode_ctr 24 48 +24 dropbear_mode_cbc 24 48 +24 dropbear_chachapoly_mac - 24 +24 dropbear_chachapoly - 24 +24 gen_new_keys 848 854 +6 ------------------------------------------------------------------------------ (add/remove: 14/0 grow/shrink: 10/0 up/down: 5388/0) Total: 5388 bytes * Add AES128-GCM and AES256-GCM authenticated encryption * Add general AES-GCM mode. * Add aes128-gcm@openssh.com and aes256-gcm@openssh.com algo using LibTomCrypt gcm routines. AES-GCM is combination of AES CTR mode and GHASH, slower than AES-CTR on CPU w/o dedicated AES/GHASH instructions therefore disabled by default. Compiling in will add ~6kB to binary size on x86-64. function old new delta gcm_process - 1060 +1060 .rodata 26976 27808 +832 gcm_gf_mult - 820 +820 gcm_add_aad - 660 +660 gcm_shift_table - 512 +512 gcm_done - 471 +471 gcm_add_iv - 384 +384 gcm_init - 347 +347 dropbear_gcm_crypt - 309 +309 encrypt_packet 1068 1270 +202 decrypt_packet 756 897 +141 gcm_reset - 118 +118 read_packet 543 637 +94 read_kex_algos 792 880 +88 sshciphers 280 360 +80 gcm_mult_h - 80 +80 dropbear_gcm_start - 62 +62 dropbear_mode_gcm - 48 +48 dropbear_mode_none 24 48 +24 dropbear_mode_ctr 24 48 +24 dropbear_mode_cbc 24 48 +24 dropbear_ghash - 24 +24 dropbear_gcm_getlength - 24 +24 gen_new_keys 848 854 +6 ------------------------------------------------------------------------------ (add/remove: 14/0 grow/shrink: 10/0 up/down: 6434/0) Total: 6434 bytes
| * | Mention Ed25519 in dropbearkey man (#94)Vladislav Grishenko2020-05-251-1/+2
| | |
| * | Add files via upload (#90)jcmathews2020-05-251-1/+3
| | | | | | | | | | | | When SSHKeepAlive is enabled, dropbear idletimeout is not working as expected.
| * | scp.c: Port OpenSSH CVE-2018-20685 fix (#80)Haelwenn Monnier2020-05-251-1/+2
| |/
| * When explicitly passing --disable-fuzz to ./configure fuzz was actuallyAlexander Dahl2020-03-271-5/+12
| | | | | | | | | | | | enabled. Signed-off-by: Alexander Dahl <ada@thorsis.com>
| * Update remaining advise to edit options.hAlexander Dahl2020-03-102-2/+2
| | | | | | | | You should edit localoptions.h instead.
| * Handle early exit when addrstring isn't setMatt Johnston2020-03-181-6/+14
| |
| * Improve address logging on early exit messages (#83)Kevin Darbyshire-Bryant2020-03-182-15/+11
| | | | | | | | | | | | | | | | | | | | | | | | Change 'Early exit' and 'Exit before auth' messages to include the IP address & port as part of the message. This allows log scanning utilities such as 'fail2ban' to obtain the offending IP address as part of the failure event instead of extracting the PID from the message and then scanning the log again for match 'child connection from' messages Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
| * mergeMatt Johnston2020-03-143-12/+5
| |\
| | * Set SSH_ORIGINAL_COMMAND for "dropbear -c" too, fix build withoutMatt Johnston2020-03-142-10/+4
| | | | | | | | | | | | DROPBEAR_SVR_PUBKEY_OPTIONS
| | * Don't log authorized_keys command= every timeMatt Johnston2020-03-141-2/+1
| | |
| * | Fallback for key gen without hard link support (#89)Matt Robinson2020-03-141-8/+21
| |/ | | | | | | | | | | Add a non-atomic fallback for key generation on platforms where link() is not permitted (such as most stock Android installs) or on filesystems without hard link support (such as FAT).
| * MOTD enabled by default as the manpage says (#87)zciendor2020-03-141-1/+1
| | | | | | | | The man page (https://github.com/mkj/dropbear/blob/master/dropbear.8) says MOTD will be printed by default for any login shell, but it was disabled at compile time. Probably happened by accident when this code was moved from `options.h` to `default_options.h`.
| * Add Ed25519 support (#91)Vladislav Grishenko2020-03-1130-946/+1289
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add support for Ed25519 as a public key type Ed25519 is a elliptic curve signature scheme that offers better security than ECDSA and DSA and good performance. It may be used for both user and host keys. OpenSSH key import and fuzzer are not supported yet. Initially inspired by Peter Szabo. * Add curve25519 and ed25519 fuzzers * Add import and export of Ed25519 keys
| * bring back fsync_parent_dirMatt Johnston2019-10-181-0/+4
| |
| * Bring back Dropbear patch to avoid setting AR/LD/RANLIB in LTMMatt Johnston2019-09-171-3/+4
| |
| * Prime-related bugfixes (#81)Steffen Jaeckel2019-09-173-34/+18
| | | | | | | | | | | | | | | | | | | | | | * Merge pull request #180 from czurnieden/isprimeerror Fixed bug in mp_prime_isprime (cherry picked from commit f3ff7064f3301a2fc11b84d389fd67769862d437) * do 2 MR rounds for numbers >=2048bits * back-port modified mp_prime_next_prime()
| * update ltm to 1.1.0 and enable FIPS 186.4 compliant key-generation (#79)Steffen Jaeckel2019-09-16214-26304/+17787
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * make key-generation compliant to FIPS 186.4 * fix includes in tommath_class.h * update fuzzcorpus instead of error-out * fixup fuzzing make-targets * update Makefile.in * apply necessary patches to ltm sources * clean-up not required ltm files * update to vanilla ltm 1.1.0 this already only contains the required files * remove set/get double
| * Rename EPKA -> PluginMatt Johnston2019-05-1511-81/+81
| |
| * External Public-Key Authentication API (#72)fabriziobertocci2019-05-1512-11/+355
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Implemented dynamic loading of an external plug-in shared library to delegate public key authentication * Moved conditional compilation of the plugin infrastructure into the configure.ac script to be able to add -ldl to dropbear build only when the flag is enabled * Added tags file to the ignore list * Updated API to have the constructor to return function pointers in the pliugin instance. Added support for passing user name to the checkpubkey function. Added options to the session returned by the plugin and have dropbear to parse and process them * Added -rdynamic to the linker flags when EPKA is enabled * Changed the API to pass a previously created session to the checkPubKey function (created during preauth) * Added documentation to the API * Added parameter addrstring to plugin creation function * Modified the API to retrieve the auth options. Instead of having them as field of the EPKASession struct, they are stored internally (plugin-dependent) in the plugin/session and retrieved through a pointer to a function (in the session) * Changed option string to be a simple char * instead of unsigned char *
| * Added signature for changeset ebcdb893992dMatt Johnston2019-03-271-0/+1
| |
| * Added tag DROPBEAR_2019.78 for changeset 009d52ae26d3Matt Johnston2019-03-270-0/+0
| |
| * Bump to 2019.78DROPBEAR_2019.78Matt Johnston2019-03-273-1/+12
| |
| * Fix regression where TTY modes weren't reset for clientMatt Johnston2019-03-241-5/+5
| |
| * Added signature for changeset 07b0d56d186dMatt Johnston2019-03-231-0/+1
| |
| * Added tag DROPBEAR_2019.77 for changeset 6d1bbe7d5fa5Matt Johnston2019-03-230-0/+0
| |
| * 2019.77DROPBEAR_2019.77Matt Johnston2019-03-233-1/+47
| |
| * use "openssl sha256"Matt Johnston2019-03-231-1/+1
| |
| * Update config.sub to 2019-01-05 and config.guess to 2019-03-04Matt Johnston2019-03-232-1678/+1767
| |
| * fix constness build errorMatt Johnston2019-03-212-2/+2
| |
* | try for coverityMatt Johnston2019-03-211-0/+4
| |
* | merge coverityMatt Johnston2019-03-2132-145/+282
|\ \ | |/
| * limit password length to 100Matt Johnston2019-03-212-1/+12
| |
| * Increase MAX_USERNAME_LEN to 100Matt Johnston2019-03-201-1/+1
| |
| * dropbearconvert: keyimport.c: fix BER encoding of secp521r1 keys (#69)Christian Hohnst?dt2019-03-201-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | keysizes >= 128 octets will be encoded with a 3 byte header which must be accounted by the optional-header Reproduce: master:~/build/dropbear$ ./dropbearkey -t ecdsa -s 521 -f K Generating 521 bit ecdsa key, this may take a while... master:~/build/dropbear$ ./dropbearconvert d o K L Key is a ecdsa-sha2-nistp521 key Wrote key to 'L' master:~/build/dropbear$ openssl ec < L read EC key unable to load Key 139769806448384:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:crypto/asn1/asn1_lib.c:91:
| * support openssh long option -o Port=XXXX (#68)xcko2019-03-201-0/+6
| |
| * cygwin competibility fix (#64)karel-m2019-03-201-1/+5
| |
| * drop obsolete definition for MAX_KEXHASHBUF (#65)Andre McCurdy2019-03-201-3/+0
| | | | | | | | | | | | | | | | The last code to make use of MAX_KEXHASHBUF was removed in 2005: https://github.com/mkj/dropbear/commit/736f370dce614b717193f45d084e9e009de723ce Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
| * Add a sanity check for DROPBEAR_SVR_MULTIUSER==0 modeMatt Johnston2019-03-202-1/+13
| |
View Lorry Controller Status